ARP or Address Resolution Protocol is the mechanism used by hosts in a network to map IP addresses to MAC addresses of other hosts within the same network segment. It is also used for next hop resolution between edge devices to enable routing between networks.
When a packet is created by a host intended for another host on that network, an ARP request is broadcast out out from the sender. Since this ARP request is a broadcast message it will be sent to every
other host on that network. The ARP request is then received by every other host on the network which will inspect the request to check to see if it recognised the IP address as its own. If it doesn’t the ARP request is dropped. If it does recognise the IP address as its own it will responds back to the sender who will then create an ARP table entry that creates a cache that maps that IP address to the MAC address of the correct host. Because of this devices and hosts are able to effectively communicate with each other on a network using IP addresses. Knowing the MAC address of the host you’re communicating with on the MAC layer is critical however, as data transmissions would be impossible without it because the MAC address is necessary for the physical layer of the OSI model, which handles the actual transmission of data bits.
It’s important to understand that almost every host on a network will store its own ARP table, and will be doing ARP lookups when required. When a host needs to talk to another host it will reference its own ARP table. If there is an already cached table entry there it will not perform an ARP request, rather using the information it already has stored for the host it wants to reach. If that cached entry fails, becomes invalid or is flushed the ARP request process is done over to correct any errors.
ARP tables can be configured in different ways, and ARP table entries can be in various states. In some cases an administrator might create static ARP table entires in which an IP address is mapped to a MAC address manually. These will remain in the ARP table permanently until deleted, and cannot change dynamically. On the other hand, dynamically learned entires are ARP entires that are automatically added to the cache by the hosts performing ARP requests and depending on the configuration will be removed automatically after a certain period of time.
Here’s a brief overview of how this process looks in action:
- When Host A wants to send a packet to another host on the network, lets say Host B it first checks in its own ARP table to see if it knows the MAC address of Host B.
- If it doesn’t know the MAC address of Host B, Host A sends and ARP request broadcast out to the entire network. This ARP request includes the the IP and MAC address of Host A, and the IP address of Host B. The reason that Host A includes its own IP address and MAC address is so that Host B knows where to respond back.
- Host B then receives the ARP request and verifies that it’s intended for its IP address. Host B responds back to Host A using the IP and MAC address included in the ARP request. The ARP reply includes the MAC address of Host B.
- Host A receives the ARP reply and creates the IP-to-MAC mapping of Host B’s MAC and IP in its ARP table. Now Host A knows how to send packets to Host B directly, without needing to do an ARP lookup for as long as the table entry exists.
In the overview above its also important to note that Host B won’t usually create an ARP table entry for Host A even after receiving the ARP request, rather it will perform its own ARP request if it wants to initiate communication directly with Host A.
In a normal LAN environment packets entering a host will contain a src-mac and src-ip (Source MAC Address and Source IP Address). The src-mac and src-ip are the IP address and MAC address of the sender which a receiving host will add to its ARP table and reference to send replies and responses back to the sender, however its important to note that if packets are routed through a router e.g packets that originate from a network intended for an external network with a router between the two, the src-mac will be stripped off and replaced by the routers MAC address, and any responses are then sent back to the router, which then sends the packets to the original sender on its network.
Here’s a simplified view of the process:
- Host A sends a request to Host B, which is on a different network. The request goes to a router, let’s call it Router 1.
- Router 1 uses ARP to find the MAC address of the next hop (which could be another router or Host B), and then sends the request to that device.
- Host B receives the request and processes it. It then prepares a response. However, since the original request came from a different network, Host B knows it needs to send the response back to Router 1.
- Host B sends the response to Router 1. Router 1 uses ARP to find the MAC address of Host A, and then forwards the response to Host A.
- Host A receives the response and processes it.
In a Local Area Network (LAN), devices often communicate directly with each other without involving a router. This is due to the fact that all devices in a LAN are part of the same network segment, and can reach each other via their MAC addresses.

